Remote connection: ProxyClient-Platform For AI(PAI)-阿里云帮助中心

ProxyClient is a client-side proxy tool provided by DSW. It lets you connect to a DSW instance over SSH without configuring a VPC or NAT gateway. This method is ideal for machine learning development using local tools like VS Code or a terminal.

Procedure

Step 1: Download and install DSW ProxyClient

Download the DSW ProxyClient tool and save it to your home directory.
Save the tool to the following directory based on your operating system:
- Windows operating system: Saved in the user's personal folder, for example, C:\Users\<username>.
- Linux: Save it to /root for the root user, or /home/<username> for a standard user.
- macOS: Save it to /Users/<username>.
Replace <username> with your actual username.
Download the client for your operating system:
In your terminal, make the downloaded client file executable. You can skip this step for the Windows (x86-64) version.
```
chmod 755 <proxyclient>
```
Replace <proxyclient> with the name of the downloaded client file.

Generate a configuration file.

Run the configuration command.
```
# macOS or Linux
./proxyclient config
# Windows
proxyclient.exe config
```
Important
When you run the ./proxyclient command on macOS for the first time, you might see a prompt: "proxyclient" cannot be opened because the developer cannot be verified. To proceed, open System Preferences > Security & Privacy and allow proxyclient to run.
Follow the prompts to set the path for the configuration file.
Enter a name for the configuration file. You can include a path.
Note
- Recommended: Press Enter to use the default path and filename: ~/.proxyclientconfig.
- You can also specify a custom path and filename. For example, on Windows: C:/Users/<username>/xxx/.proxyclientconfig.
- If you set a custom path, you must specify it using the -c or --config-file flag when you run the ./proxyclient add command in Step 3.

Follow the prompts to set the RegionId, AccessKey ID, AccessKey Secret, and STSToken parameters.

The following table describes the parameters.

Parameter	Description
RegionId	The ID of the region where your DSW instance is located, for example, cn-shanghai for China (Shanghai). For a list of region IDs, see Regions and zones. Important The region ID must match the region of your DSW instance.
AccessKey ID	The AccessKey pair for your Alibaba Cloud account. For more information, see Create an AccessKey pair.
AccessKey Secret
STSToken	If you are using an Alibaba Cloud account or a RAM user, leave this parameter empty. When you use a RAM role to log in, you must use temporary identity credentials and configure this parameter. For information about how to generate an STS token, see Obtain an STS temporary token. Important Ensure that the STS token is valid.

Step 2: Configure SSH authentication

You can connect to the DSW instance by using an SSH key pair or a password.

Important

For DSW instances in a dedicated resource group, after you configure authentication, click Save Image in the Actions column for the DSW instance. The public key or password you add is saved to the instance image and remains valid after the instance restarts.

Method 1: Key-based authentication (recommended)

Generate a key pair.
1. In your local terminal, run the following command to generate a key pair for password-free login. By default, an RSA key pair is created.
```
ssh-keygen
```
2. Specify where to save the key pair.
  - Recommended: Press Enter without specifying a filename. The default key pair files are ~/.ssh/id_rsa (private key) and ~/.ssh/id_rsa.pub (public key).
  - Optional: Specify a custom filename for the key pair, such as example_id_rsa.
    Note
    If you specify a custom filename, you must specify the private key file path with the IdentityFile parameter in the ~/.ssh/config file, which is generated in Step 3: Add the DSW instance proxy.
3. Follow the prompts to set a passphrase and save it locally. You will use this passphrase to connect to the DSW instance.
On the DSW instance you want to connect to, open a terminal and run the following commands. The setup_ssh.sh script automatically downloads and installs an SSH server.
```
wget https://dsw-resource.oss-cn-beijing.aliyuncs.com/tools/setup_ssh.sh
bash setup_ssh.sh
```
Follow the prompts to configure the SSH public key and start the SSH server.

Method 2: Password-based authentication

Go to the DSW instance that you want to connect to and open the terminal.
Run the following command to set the password for the root user.
```
passwd root
```
Modify the SSH configuration file to allow root login with a password.
1. Open the SSH configuration file.
```
vi /etc/ssh/sshd_config
```
2. Change the #PermitRootLogin prohibit-password setting to PermitRootLogin yes, and then save the file.
  The modified configuration is as follows.
```
# Authentication:
#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
```
Restart the SSH server to apply the changes.
```
service ssh stop
service ssh start
```

Step 3: Add the DSW instance proxy

From the instance list, copy the ID of the DSW instance you want to connect to.
Click the target instance to expand its details panel. In the panel, find the Instance ID field (formatted like dsw-xxxxxxd6) and copy the instance ID to use for the proxy configuration.
In your local terminal, run the following command to add a DSW instance as an SSH target host.
Replace <instance_id> with the instance ID that you copied.
```
# macOS or Linux
./proxyclient add -i=<instance_id>
# Windows
proxyclient.exe add -i=<instance_id>
```

View the contents of the .ssh/config file to confirm that the proxy settings have been applied.

# macOS or Linux
cat .ssh/config
# Windows
# In your local terminal, navigate to your user home directory and run the following command.
# You can also double-click the config file to open it.
explorer .ssh\config

Optional: If you used a custom filename, such as example_id_rsa, when you generated the key pair, modify the ~/.ssh/config file as shown in the following example. Use the IdentityFile parameter to specify the path to the private key file used for the connection.
```
Host dsw-b7a2765b267e****
    HostName dsw-b7a2765b267e****
    User root
    ProxyCommand ~/proxyclient connect --region-id=cn-hangzhou --instance-id=dsw-b7a2765b267e**** --config-file=***
    ServerAliveInterval 30
    IdentityFile ~/.ssh/example_id_rsa
```

Step 4: Connect to the DSW instance

Connect from a terminal

Open a terminal tool, such as your local command-line interface, and run the following command to log in to the remote instance.

Replace <instance_id> with the ID of your DSW instance.

ssh <instance_id>

You can also use the scp command to copy files or directories between your local machine and the remote instance.

# Copy a local file to the remote instance.
scp local_file_path root@<instance_id>:<remote_file_path>
# Copy a local directory to the remote instance.
scp -r local_dir root@<instance_id>:<remote_dir>
# Copy a file from the remote instance to your local machine.
scp root@<instance_id>:<remote_file_path> <local_file_path>
# Copy a directory from the remote instance to your local machine.
scp -r root@<instance_id>:<remote_dir> <local_dir>

Connect from VS Code

The steps may vary depending on your version of VS Code. For more information, see the Visual Studio Code documentation.

Open VS Code on your local machine and install the Remote Connection extension.
Click the Extensions icon in the Activity Bar to open the marketplace. In the search box, enter Remote - SSH. Find the Remote - SSH extension and click Install.
In the Activity Bar of VS Code, click the Remote Explorer icon .
The Remote Explorer panel opens. You can view configured remote hosts, such as dsw-*, under the SSH node.
Add a new remote connection to the instance.
1. Click the Add New icon next to Remote Connection. In the text box that appears, enter the DSW instance ID and press Enter.
2. Click to select the config file to update.
  We recommend selecting the configuration file at C:\Users\<username>\.ssh\config.
3. In the Host added dialog that appears in the lower-right corner of VS Code, click Connect.
4. Click Linux to select the operating system for the DSW instance.
5. In the text box, enter the passphrase you saved locally in Step 2 and press Enter.
  After the connection is successful, VS Code displays a Welcome page. The main content area includes Start shortcuts (New File..., Open File..., Open Folder..., Clone Git Repository...) and a Walkthroughs list (such as Get Started with VS Code and Get Started with WSL). This indicates that you have successfully connected to the instance from VS Code. You can now open a remote folder to begin local development.
For subsequent connections to this DSW instance, you can right-click the target instance, select a connection method, and then follow the prompts.
Connection methods include Connect to Host in Current Window and Connect to Host in New Window.

FAQ

Q: What is the difference between Direct SSH and ProxyClient?

	Method A: Direct SSH	Method B: ProxyClient
Features	Requires configuring network components like a VPC and a NAT gateway. The connection is faster and more stable.	No additional network components are required. However, the connection speed and stability may be poor.
Supported instances	All instance types are supported, except for those with specifications starting with `ecs.ebm` in a public resource group.	All instance types.
Authentication method	Authenticates with an SSH key pair.	First, authenticate through ProxyClient by providing your Alibaba Cloud AccessKey information. Then, you authenticate with an SSH key pair.
Access method	Public access (requires a NAT gateway and an EIP). Private access from within your VPC.	Public access.
Configuration guide	Remote connection: Direct SSH	Remote connection: ProxyClient
How it works	PAI automatically creates a DNAT rule on the NAT gateway to forward public SSH requests to your DSW instance.	All traffic is routed through a PAI proxy server.
Billing note	For public access, the NAT gateway and EIP incur ongoing charges, even when the DSW instance is stopped. If they are no longer needed, delete them promptly.	This configuration does not incur additional fees.

Q: Why does the connection fail for a RAM user?

If you use a RAM user's AccessKey to connect via ProxyClient, you must ensure that the primary account has granted the paidsw:GetToken permission to the RAM user. Otherwise, authentication will fail. The steps to add this permission are as follows:

Grant permissions

Log on to the RAM console with your Alibaba Cloud account.

Create a policy with the following content:

{
   "Version": "1",
   "Statement": [
     {
       "Effect": "Allow",
       "Action": "paidsw:GetToken",
       "Resource": "*"
     }
   ]
}

Go to the RAM authorization page and attach the policy created in the previous step to the RAM user.

Q: Why does the connection time out or fail?

Check that in the configuration file generated by proxyclient.exe, the RegionId is the same as the region of your DSW instance.

Q: Can I create multiple users for SSH login?

By default, a DSW instance provides only the root user for SSH login. Currently, DSW does not natively support creating multiple independent users and configuring separate, isolated SSH logins for them. You can try to manually create new users within the instance, but this is not an officially supported or standard method.

Q: How to find workspace files in a local IDE?

After logging in via SSH, the default directory might be the root user's home directory (/root). Your work files are typically located in the mounted data disk path, such as /mnt/workspace. In VSCode, you can use the File > Open Folder feature in the sidebar to manually select and open the correct working directory on the server. You can then view your project files in the file explorer.